MOBILE SECURITY FRAMEWORK(MOBSF) installation in Ubuntu/Linux Mint

Mobile Security Framework (MobSF) is an intelligent, all-in-one open source mobile application (Android/iOS/Windows) automated pen-testing framework capable of performing static and dynamic analysis. It can be used for effective and fast security analysis of Android, iOS and Windows mobile Applications and supports both binaries (APK, IPA & APPX ) and zipped source code.

MobSF can also perform Web API Security testing with it's API Fuzzer that can do Information Gathering, analyze Security Headers, identify Mobile API specific vulnerabilities like XXE, SSRF, Path Traversal, IDOR, and other logical issues related to Session and API Rate Limiting.

To Install & Configure MOBSF: System Requirements:

Ubuntu 14.04
Ram >= 4GB
HDD >= 50GB
Python 2.7
Oracle JDK 1.7 or higher

INSTALL ORACLE VITUALBOX

wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add –

Install VirtualBox:

$sudo apt-get update


$sudo apt-get install vitualbox-5.0

Download latest release of MobSF: 

https://github.com/ajinabraham/Mobile-Security-Framework-MobSF/releases

Download MobSF VM 0.2 ova file:

 https://goo.gl/h7CCxx

Now Copy file MobSF you download:

 ---> for Windows path: C:\MobSF
----> for Linux path: /home/[username]/MobSF

Install MobSF Python by using pip.

For Ubuntu:
$sudo apt-get -y install python-pip

For Windows:
Download file: https://bootstrap.pypa.io/get-pip.py

Run command:

python get-pip.py

INSTALL MOBSF

Windows: C:\Python27\Scripts\pip.exe install -r requirments.txt

Ubuntu: pip install -r requirements.txt

Install complete!

REST API Interview Questions And Answers For Software Testers

The common information about REST API for Interview section.

API testing interview questions and answers

1) Explain what is REST and RESTFUL?

REST:

REST represents REpresentational  State Transfer; it is a relatively new aspect of writing web API.   In REST architecture, a REST Server provides access to resources and REST client accesses and presents those resources. Here each resource is identified by URIs or global IDs. REST uses different ways to represent a resource like text, JSON, and XML. XML and JSON are the most popular representations of resources these days.

RESTFUL Web Service

Mostly, there are two kinds of Web Services which are quite popular.

1. SOAP (Simple Object Access Protocol) which is an XML-based way to expose web services.

2. Web services developed using REST style are known as RESTful web services. These web services use HTTP methods to implement the concept of REST architecture. A RESTful web service usually defines a URI, Uniform Resource Identifier a service, provides resource representation such as JSON and set of HTTP Methods.

2) Explain the architectural style for creating web API?

The architectural style for creating web api are

• HTTP for client server communication
• XML/JSON as formatting language
• Simple URI as the address for the services
• Stateless communication

3) Mention what are the HTTP methods supported by REST?

HTTP methods supported by REST are:

• GET: It requests a resource at the request URL. It should not contain a request body as it will be discarded. Maybe it can be cached locally or on the server.
• POST: It submits information to the service for processing; it should typically return the modified or new resource
• PUT: At the request URL it update the resource
• DELETE: At the request URL it removes the resource
• OPTIONS: It indicates which techniques are supported
• HEAD: About the request URL it returns meta information

What is latest technology/trends in Software testing?

Feature of Software testing, In the next few years , testing will set some new trends that will amaze the world.

Here we go with some of the latest trends in testing domain.

Source

1. 
   The Future belongs to Open Source Tools: The next decade (may be more!) will see a lot of Open source tools in action as more and more organizations will adopt them for proper implementation of Agile, DevOps, and Test Automation. Support communities for the open source tools can only become more and more involved and active.
2. Quality @ High speed is the new mantra: Everyone wants the best products in the fastest possible time. This is making organizations focus on providing the best user experience along with the fastest time to market. The speed is only going to increase (and the quality better) with the latest technologies and tools at the disposal of teams.
3. Software Development Engineers in Test (SDETs) will be in huge demand: SDETs have been existing among us since almost a decade, but their role was very different from traditional testing roles. That said, by early 2020, almost all testers will need to wear an SDET hat to be successful in the field of Test Automation, that is going to become mainstream.

OWASP ZAP Tool : Security testing tool with implementation and reports

Introduction on the OWASP ZAP Tool

OWASP ZAP : 

The OWASP Foundation came online on December 1st 2001 it was established as a not-for-profit charitable organization in the United States on April 21, 2004 to ensure the ongoing availability and support for our work at OWASP.

Why to go for the  OWASP ZAP ? 

1. Open source Tool

2. Governed by rough consensus & running code

3. Abide by a code of ethics (see ethics)

4. Not-for-profit

5. Not driven by commercial interests

6. Risk based approach

7. Ideal for the Beginers

8. For Automating the Security Test

9. Cross Platforms 

10. Easy to Install 

11. Internationalized

12. Compatible with Other tools

OWASP ZAP TOP 10 Features  : 

1. Injection 

2. Broken Authentication and Session Management

3. Cross-site Scripting (XSS)

4. Broken Access Control 

5. Security Misconfiguration 

6. Sensitive Data Exposure 

7. Insufficient Attack Protection 

8. Cross Site Request Forgery (CSRF)

9. Using Component with known Vulnerabilities

10. Underprotected API’s 

Explanation of the Above Features in Details :- 

1. Injection

Any source of data can be an injection vector

Often found in SQL,XPATH or NoSQL queries

It occurs when application sends untrusted data to the interpreter

For example, Attacker can execute malicious SQL statements that control a web application's database server.

How to prevent?